Systems and methods for determining a topology of a network comprising a plurality of intermediary devices and paths

ABSTRACT

Systems and methods are disclosed for determining a topology of a network comprising a plurality of intermediary devices and intermediary paths. One method includes transmitting probes having a TTL value with a destination set to a destination device; receiving, for each probe transmitted, a response including an IP address of a responding device; determining whether more than one responding device has responded to the probes; determining whether more than one responding device has been found for two previous transmissions of probes when more than one responding device has responded to the probes; and transmitting, for each more than one responding device, probes having a decreased TTL value with a destination set to one of the IP addresses of the more than one responding devices, when more than one responding device has been found for two previous transmissions.

TECHNICAL FIELD

The present disclosure relates generally to the field of computernetwork management. More particularly, the present disclosure relates todetermining the topology of a network having multiple devices and paths.

BACKGROUND

A networked domain may have a number of devices responsible for routingthe traffic around the network. These devices may be routers, servers,and other network hardware and software that support layer 2 and layer 3network layers, which are data link layers of the InternationalStandards Organization's (“ISO”) Open System Interconnection (“OSI”)standard for networking. Within any given network, there may be multipleroutes and redundant back-up routes between the devices to ensurenetwork integrity when one or more devices fail.

As a network grows, devices may be moved, added, removed, or replaced.Thus, the routes between the devices may be moved or altered. As aresult, any documentation of the original network design may beoutdated. When problems occur, troubleshooting may be difficult withoutaccurate information about the network's topology.

Some devices may include special hardware or functions that allow themto determine their connections. The special hardware or functions may beused to determine the connections at each device, compile theinformation, and determine the topography of the network. However, eachdevice must include the special hardware or functions to compile theinformation.

Packet Internet Groper (“PING”) is a known function that may send anInternet Control Message Protocol (“ICMP”) packet to a specified addressof a device and wait for a reply from the device. If a reply isreceived, then a connection to the addressed device is confirmed.However, PING does not determine each connection to a device. Further,PING is not be able to determine an address for an unknown device.

Traceroute is another known function that may be used to trace outpacket routes through Internet connections. Traceroute traces the routethat a packet sent from one device takes, shows how many hops the packettakes, and identifies the device at each hop. Traceroute operates bysending packets with a time-to-live (“TTL”) field set to a low value.When a packet does not reach its destination because the number of hopsexceeds the TTL value, the last host that the packet did reach returnsthe packet and identifies itself. Traceroute sends a series of packetsand increments the TTL of each one. Each failed packet is returned withan identification of the next host. By sending multiple packets, theidentity of the device at each hop on the way to the destination may bedetermined. Traceroute may be used to determine a route between a sourcedevice and a destination device, but it does not determine back-uproutes, alternative paths, or the topology of the network. It is alsodependent on the particular path that a packet takes at the time thatthe utility is run. Accordingly, the information that may be obtained isvery limited.

The present disclosure is directed to overcoming these limitations inorder to obtain a better understanding of a network's topology.

SUMMARY OF THE DISCLOSURE

Embodiments of the present disclosure include systems and methods fordetermining a topology of a network comprising a plurality ofintermediary device and intermediary paths.

According to certain embodiments, computer-implemented methods aredisclosed for determining a topology of a network comprising a pluralityof intermediary devices and intermediary paths. One method includestransmitting, from a source device, at least two probes having atime-to-live (“TTL”) value with a destination set to a destinationdevice; receiving, at the source device for each probe transmitted, aresponse, the response including an Internet protocol (“IP”) address ofa responding device; determining, by the source device, whether morethan one responding device has responded to the at least two probes;determining, by the source device, whether more than one respondingdevice has been found for two previous transmissions of probes when morethan one responding device has responded to the at least two probes; andtransmitting, from the source device for each more than one respondingdevice, at least two probes having a decreased TTL value with adestination set to one of the IP addresses of the more than oneresponding devices, when more than one responding device has been foundfor two previous transmissions.

According to certain embodiments, systems are disclosed for determininga topology of a network comprising a plurality of intermediary devicesand intermediary paths. One system includes a data storage device thatstores instructions determining a topology of a network comprising aplurality of intermediary device and intermediary paths; and a processorconfigured to execute the instructions to perform a method includingtransmitting at least two probes having a time-to-live (“TTL”) valuewith a destination set to a destination device; receiving, for eachprobe transmitted, a response, the response including an Internetprotocol (“IP”) address of a responding device; determining whether morethan one responding device has responded to the at least two probes;determining whether more than one responding device has been found fortwo previous transmissions of probes when more than one respondingdevice has responded to the at least two probes; and transmitting, foreach more than one responding device, at least two probes having adecreased TTL value with a destination set to one of the IP addresses ofthe more than one responding devices, when more than one respondingdevice has been found for two previous transmissions.

According to certain embodiments, a non-transitory computer readablemedium is disclosed that stores instructions that, when executed by acomputer, cause the computer to perform a method for determining atopology of a network comprising a plurality of intermediary devices andintermediary paths. One method includes transmitting, from a sourcedevice, at least two probes having a time-to-live (“TTL”) value with adestination set to a destination device; receiving, at the source devicefor each probe transmitted, a response, the response including anInternet protocol (“IP”) address of a responding device; determining, bythe source device, whether more than one responding device has respondedto the at least two probes; determining, by the source device, whethermore than one responding device has been found for two previoustransmissions of probes when more than one responding device hasresponded to the at least two probes; and transmitting, from the sourcedevice for each more than one responding device, at least two probeshaving a decreased TTL value with a destination set to one of the IPaddresses of the more than one responding devices, when more than oneresponding device has been found for two previous transmissions.

Additional objects and advantages of the disclosed embodiments will beset forth in part in the description that follows, and in part will beapparent from the description, or may be learned by practice of thedisclosed embodiments. The objects and advantages of the disclosedembodiments will be realized and attained by means of the elements andcombinations particularly pointed out in the appended claims.

It is to be understood that both the foregoing general description andthe following detailed description are exemplary and explanatory onlyand are not restrictive of the scope of disclosed embodiments, as setforth by the claims.

BRIEF DESCRIPTION OF THE DRAWINGS

The accompanying drawings, which are incorporated in and constitute apart of this specification, illustrate various exemplary embodiments andtogether with the description, serve to explain the principles of thedisclosed embodiments.

FIG. 1 depicts a schematic diagram of a computer network in which anetwork topology may be determined, according to an exemplary embodimentof the present disclosure;

FIGS. 2A-2C depict schematic diagrams illustrating control and data flowbetween a source device and a destination device on a computer network,according to an exemplary embodiment of the present disclosure;

FIG. 3 depicts a schematic diagram illustrating control and data flowbetween a source device and a destination device on a computer networkwith multiple paths and intermediary devices, according to an exemplaryembodiment of the present disclosure;

FIG. 4 depicts a flow diagram of an exemplary method for determining atopology of a network comprising a plurality of intermediary device andintermediary paths, according to an exemplary embodiment of the presentdisclosure; and

FIG. 5 is a simplified functional block diagram of a computer that maybe configured as a device for executing the method of FIG. 4, accordingto exemplary embodiments of the present disclosure.

DETAILED DESCRIPTION OF EMBODIMENTS

Embodiments of the present disclosure may be implemented by using probessent from a source device on a network and then piecing all of thecollected information together to determine the overall topology of thenetwork. Probes may be used to sequentially trace the routes thatpackets of data traverse to reach their destination. By increasing anddecreasing the number of hops taken from a source device and changingthe destination of the packets, an overall topology of the network maybe determined.

Referring now to the figures, FIG. 1 depicts an exemplary model of anetwork 100 including a plurality of network devices 110, 115, and 120having one or more network connections between the network devices 110,115, and 120. Source device 110 may be a source of a packet of data tobe transmitted destination device 120. Of course, any of the networkdevices 110, 115, and 120 may be referred to as a source device, whichmay be used as an initial source for determining the overall topology ofthe network, and/or a destination device, which may be used an a initialdestination, as will be described in more detail below. While FIG. 1illustrates device 110 as being the initial source device and device 120as being the initial destination device of network 100, one willappreciate that the source and destination may occur anywhere withnetwork 100 and are not restricted to any location or device within thenetwork topology.

There may be several different protocols that control data transferbetween the network devices, with each protocol fulfilling a particularneed. For example, the Transmission Control Protocol (“TCP”) mayguarantee reliable and in-order delivery of data from a source device toa destination device. The User Datagram Protocol (“UDP”) may be used,but does not necessarily provide reliable and in-order delivery of datafrom a source device to a destination device. The Internet ControlMessage Protocol (“ICMP”) may be used primarily to report error messagesthrough the network. The ICMP may define several types of packets,including the time-to-live exceeded and port unreachable messages thatare critical parts of the probe utility. Details of which will bepresented in more detail below.

The protocols may also rely on one another. For example, the well-knownHyper Text Transfer Protocol (“HTTP”) is built on top of the TCPprotocol, which is built on top of the Internet Protocol (“IP”). Giventhe layered reliance of the aforementioned protocols, they may also bereferred to as “layers.”

In the context of modeling networks with directed graphs as shown inFIG. 1, the IP layer (layer 3 in the OSI standard), is the layer whichmay be most commonly modeled as a directed graph. Other OSI layers, forexample layer 2, may also be placed in the context of a directed graph,which may include bridges and switches as nodes. Various embodiments ofthe disclosure presented herein may be widely applicable to anynetworking layer and are not restricted to the IP layer.

With a layer 3 network, a data path may include a source device and adestination device and a series of intermediate devices. Packetsarriving at a device may be queued, and await transmission to the nextdevice according to the packet's protocol as handled by the device.Physically, a queue may include a block of computer memory thattemporarily stores the packets. If the queue is full when a packetarrives, it may be discarded. Otherwise, the packet may be held until itreaches the front of the queue and then forwarded to the next device onthe way to the destination device. This queuing mechanism may beresponsible for observed packet losses and, to a large extent, forpacket delays.

Referring back to FIG. 1, the source device 110 and destination device120 may be wired and/or wireless devices that are capable oftransferring data over a data network. Moreover, as mentionedpreviously, network 100 is greatly simplified for ease of explanation,and one should appreciate that embodiments of the disclosure areapplicable to any type of communications network, such as, for example,a global communication network such as the Internet, a wide areanetwork, a metropolitan area network, a local area network, a wirelesscellular network, a public switched telephone network (“PSTN”), and/or asatellite network, as well as portions or combinations of these and/orother communication networks.

In one embodiment, the probe utility may be used to determine thetopology of the network. For example, a trace may transmit two or morepackets (also referred to as probes) from a source device, and thenexploit the time-to-live (“TTL”) field of a packet to determine theroute that the packet takes to the destination device. When anintermediary network device receives an IP packet, the intermediarydevice may decrement the TTL value and forward the packet toward thedestination device, according to the routing table of the intermediarydevice.

FIGS. 2A-2C depict schematic diagrams, in accordance with exampleembodiments, illustrating control and data flow between a source deviceand destination device on a network. As shown in FIG. 2, the system mayinclude a source device 200, a destination device 202, a firstintermediary device (e.g., router) 204, and a second intermediary device206, all connected via a network 208. In the example shown, a trace isinitiated from source device 200. A probe may be addressed to adestination device 202 to allow a user or process to discover thenetwork path between the source device 200 and the destination device202. The probe may include a TTL value of 1. At the first intermediarydevice 204, the TTL may be decremented by 1 to 0, causing the firstintermediary device 204 to transmit an error message. The type of errormessage sent may be dependent on the method of probe used. In oneembodiment, an Internet Control Message Protocol (“ICMP”) Time Exceededmessage may be transmitted by a device that detects that the TTL hasexpired. In the example shown in FIG. 2A, source device 200 may transmita probe with a TTL of 1 to the first intermediary device 204, whichtransmits an ICMP Time Exceeded message after decrementing the TTL valueand determining that the TTL value of the message has expired.

The next step in a trace process is depicted in FIG. 2B, where sourcedevice 200 transmits a second probe with an incrementally higher TTLvalue (e.g., a TTL of 2), which is processed by the first intermediarydevice 204. The first intermediary device 204 decrements the TTL to 1and forwards the probe towards the destination device 202. The secondintermediary device 206, which in this example is the next hop in thenetwork path from source device 200 to destination device 202, receivesthe probe and processes the probe. In this situation, the secondintermediary device 206 decrements the TTL to 0 and transmits an ICMPerror message (e.g., ICMP Time Exceeded message) to the originator ofthe probe (e.g., source device 200).

FIG. 2C depicts the last step in this example trace process. Asdescribed with regard to the previous step illustrated in FIG. 2B, thesource device 200, increments the TTL of the probe and transmits probetowards the destination device 202. At the first intermediary device204, the TTL is decremented and analyzed. Because the TTL is not reducedto 0, the probe is forwarded using network routing processes. In theexample shown, the next hop in the network path is the secondintermediary device 206. When the probe is received at the secondintermediary device 206, the second intermediary device 206 decrementsthe TTL and analyzes the resulting TTL value. In this case, the TTL isreduced to 1, so the second intermediary device 206 does not transmit anICMP error message, and forwards the probe to the destination device202. In an example embodiment, the probe may be addressed to an unknownand/or unused destination UDP port. As such, when the probe reaches thedestination device, a different ICMP message may be transmitted inresponse. In the example illustrated, an ICMP Destination Unreachablewith a port unreachable code message may be transmitted in response tothe probe.

The source device 200 may use the responsive messages (e.g., ICMP TimeExceeded or ICMP Destination Unreachable messages) to determine networklatency times, discover network paths to a destination device, and/orobtain other information, such as data included in a multi-part ICMPmessage used for troubleshooting network issues. Probe data andprocesses may also be used in conjunction with other network analysistools, such as PING, to further expose network information, such asnetwork topology, network structure, device identification, or the like.

As mentioned above, trace process may transmit two or more probes fromthe source device, per router hop, resulting in two or more latencymeasurements to each hop. In some instances, the two or more probes maytraverse different paths. Within a complex IP network, there may be oneor more devices, such as a load balancer, directing traffic acrossmultiple devices between a particular source device and destinationdevice.

As shown in FIG. 3, each of the probes may travel down a different path,depending on how a hashing algorithm is configured on each of theintermediary devices. In this example embodiment, each of the threeprobes from the source device 300 may travel to the intermediary device304. After the first hop, two of the probes may travel to intermediarydevice 306 and the third probe may travel to intermediary device 312.The subsequent probes may travel to the next intermediary devices in thenetwork, such as devices 308 and 314, then to intermediary device 310,and finally, to destination device 302. The results of a probe mayappear to be bouncing back and forth between locations, and may bedifficult to parse.

In order to obtain a more accurate network topography, the method 400,as shown in FIG. 4, may be employed. At step 402, two or more probes maybe transmitted from a source device with a destination set to adestination device with an initial TTL value, such as 1. At step 404,the source device may receive a response from each probe transmitted.The response may include an IP address of the device transmitting theresponse, response times, timeouts, DNS, etc. The source device may thenstore the response including the TTL value, IP address of the devicetransmitting the response, response times, timeouts, DNS, etc. at step406.

At step 408, the source device may determine whether the destination hasbeen reached by any of the two or more probes based on the responsesreceived. The source device may determine whether the destination hasbeen reached based on the messages of the response. For example, an ICMPTime Exceeded message or an ICMP Destination Unreachable with a portunreachable code message may be transmitted in response to the probe. Ifthe message is ICMP Destination Unreachable with a port unreachable codemessage, then it may be determined that the destination device has beenreached.

Alternatively, the source device may determine the destination has beenreached by comparing the set destination to the IP address of eachresponse. When the set destination is equal to the IP address of thedevice transmitting the response, then it may be determined that thedestination device has been reached. When the destination has beendetermined to be reached, the method may proceed to step 432 and end.

If the destination is determined not to have been reached, the sourcedevice may determine whether multiple intermediary devices have beenfound at step 410. For each probe transmitted, the source device maycompare the IP addresses of the device transmitting the response to theprobe. For example, if the IP addresses of the devices transmitting theresponses to the probes are not the same, then multiple intermediarydevices have been found.

If multiple intermediate devices have not been found, then the multiplepath flag may be cleared, at step 412. For example, the multiple flagmay be set to zero. After clearing the multiple path flag, the methodmay proceed to step 414, in which the TTL value is incremented. Themethod may then proceed to step 416, where the source device maytransmit two or more probes with the destination set to the destinationdevice and with the incremented TTL value. The method 400 may thenproceed to step 404.

If multiple intermediary devices have been found, the source device maydetermine whether multiple intermediary devices have been found for thetwo previous transmissions of probes. For example, if multipleintermediary devices have been found, then a multiple path flag may beincremented at step 418. For example, the multiple path flag may beincremented from zero to one. The source device at step 420 may thendetermine whether the multiple path flag is greater than one. If themultiple path flag is not greater than one, then the method will proceedto step 414, in which the TTL value is incremented.

If the multiple path flag is greater than one, then the method willproceed to step 422 in which the TTL value is decremented. Then, at step424, for each intermediary device found, the source device may transmitprobes with a destination set to one of the intermediary devices andwith the TTL value being decremented. At step 426, the source device mayreceive a response from each probe transmitted. The response may includean IP address of the device transmitting the response, response times,timeouts, DNS, etc. The source device may then store the response,including the TTL value, IP address of the device transmitting theresponse, response times, timeouts, DNS, etc. at step 428. At step 430,the source device may increment the TTL value, and then proceed to step414, in which the TTL value is again incremented.

The above disclosed method may also be used in network troubleshooting.Additionally, the responses may be obtained from other source devicesand stored in a central database. This may allow building of a detailedlive map of a network, as well as being able to determine live healthstatistics for paths and devices.

FIG. 5 is a simplified functional block diagram of a computer that maybe configured as devices, switches, controllers, and/or servers forexecuting the methods, according to exemplary an embodiment of thepresent disclosure. Specifically, in one embodiment, any of the devices,switches, controllers, and/or servers may be an assembly of hardware 500including, for example, a data communication interface 560 for packetdata communication. The platform may also include a central processingunit (“CPU”) 520, in the form of one or more processors, for executingprogram instructions. The platform typically includes an internalcommunication bus 510, program storage, and data storage for variousdata files to be processed and/or communicated by the platform such asROM 530 and RAM 540, although the system 500 often receives programmingand data via network communications 570. The system 500 also may includeinput and output ports 550 to connect with input and output devices suchas keyboards, mice, touchscreens, monitors, displays, etc. Of course,the various system functions may be implemented in a distributed fashionon a number of similar platforms, to distribute the processing load.Alternatively, the systems may be implemented by appropriate programmingof one computer hardware platform.

Program aspects of the technology may be thought of as “products” or“articles of manufacture” typically in the form of executable codeand/or associated data that is carried on or embodied in a type ofmachine-readable medium. “Storage” type media include any or all of thetangible memory of the computers, processors or the like, or associatedmodules thereof, such as various semiconductor memories, tape drives,disk drives and the like, which may provide non-transitory storage atany time for the software programming. All or portions of the softwaremay at times be communicated through the Internet or various othertelecommunication networks. Such communications, for example, may enableloading of the software from one computer or processor into another, forexample, from a management server or host computer of the mobilecommunication network into the computer platform of a server and/or froma server to the mobile device. Thus, another type of media that may bearthe software elements includes optical, electrical and electromagneticwaves, such as used across physical interfaces between local devices,through wired and optical landline networks and over various air-links.The physical elements that carry such waves, such as wired or wirelesslinks, optical links, or the like, also may be considered as mediabearing the software. As used herein, unless restricted tonon-transitory, tangible “storage” media, terms such as computer ormachine “readable medium” refer to any medium that participates inproviding instructions to a processor for execution.

While the presently disclosed methods, devices, and systems aredescribed with exemplary reference to transmitting data, it should beappreciated that the presently disclosed embodiments may be applicableto any environment, such as a desktop or laptop computer, an automobileentertainment system, a home entertainment system, etc. Also, thepresently disclosed embodiments may be applicable to any type ofInternet protocol.

Other embodiments of the disclosure will be apparent to those skilled inthe art from consideration of the specification and practice of thedisclosure disclosed herein. It is intended that the specification andexamples be considered as exemplary only, with a true scope and spiritof the disclosure being indicated by the following claims.

1-20. (canceled)
 21. A computer-implemented method for determining atopology of a network, the method comprising: transmitting, from asource device, a first probe and a second probe to a destination device;in response to each of the transmitted first probe and second probe,receiving, at the source device, at least a first response from at leasta first intermediary device; determining, by the source device, whethera second response has been received from a second intermediary device inresponse to either of the transmitted first probe or second probe; inresponse to determining that a second intermediary device has respondedto either of the first probe or second probe, determining, by the sourcedevice, whether either of the first intermediate device or the secondintermediate device have responded to two previous transmissions ofprobes; and in response to determining that either of the firstintermediate device or the second intermediate device has responded totwo previous transmissions of probes, storing, by the source device, aresponse received from each of the first intermediate device or thesecond intermediate device in response to either of the transmittedfirst probe or second probe, wherein the source device is configured todetermine a network topology based on the stored responses received fromthe first intermediary device or the second intermediary device.
 22. Themethod of claim 21, wherein determining whether a second intermediarydevice has responded to either of the first probe or second probeincludes: comparing, by the source device, the IP address of the firstintermediary device or the second intermediary device for each responsereceived to verify that they are each not the same IP address.
 23. Themethod of claim 21, wherein determining whether each of the firstintermediate device or the second intermediate device has responded totwo previous transmissions of probes includes: incrementing, by thesource device, a multiple path flag; and determining, by the sourcedevice, whether the multiple path flag is greater than one.
 24. Themethod of claim 21, further comprising: storing, by the source devicefor each probe transmitted, the response received and the TTL value ofthe transmitted probe.
 25. The method of claim 21, further comprising:determining, by the source device, whether an IP address of a responseis an IP address of the destination device.
 26. The method of claim 21,further comprising: increasing, by the source device, the TTL value ofeach of the first probe and the second probe when more than oneresponding device has not responded to each of the first probe and thesecond probe; and transmitting, from the source device, at least twoprobes having the increased TTL value with a destination set to adestination device.
 27. The method of claim 21, further comprising:increasing, by the source device, the TTL value each of the first probeand the second probe in response to determining that more than one ofeither the first intermediary device or the second intermediary devicehas not responded to the two previous transmissions of probes; andtransmitting, from the source device, at least two probes having theincreased TTL value with a destination set to a destination device. 28.A system determining a topology of a network comprising a plurality ofintermediary devices and intermediary paths, the system including: adata storage device that stores instructions determining a topology of anetwork comprising a plurality of intermediary device and intermediarypaths; and a processor configured to execute the instructions to performa method including: transmitting, from a source device, a first probeand a second probe to a destination device; receiving, for each probetransmitted, at least a first response from at least a firstintermediary device; determining whether a second response has beenreceived from a second intermediary device in response to either of thetransmitted first probe or second probe; determining that either of thefirst intermediate device or the second intermediate device hasresponded to two previous transmissions of probes; and storing, by thesource device, a response received from each of the first intermediatedevice or the second intermediate device in response to either of thetransmitted first probe or second probe, wherein the source device isconfigured to determine a network topology based on the stored responsesreceived from the first intermediary device or the second intermediarydevice.
 29. The system of claim 28, wherein determining whether a secondintermediary device has responded to either of the first probe or secondprobe includes: comparing, by the source device, the IP address of thefirst intermediary device and the second intermediary device for eachresponse received to verify that they are each not the same IP address.30. The system of claim 28, wherein determining whether each of thefirst intermediate device or the second intermediate device hasresponded to two previous transmissions of probes includes:incrementing, by the source device, a multiple path flag; anddetermining, by the source device, whether the multiple path flag isgreater than one.
 31. The system of claim 28, wherein the processor isfurther configured to execute the instructions to perform the methodincluding: storing, by the source device for each probe transmitted, theresponse received and the TTL value of the transmitted probe.
 32. Thesystem of claim 28, wherein the processor is further configured toexecute the instructions to perform the method including: determining,by the source device, whether an IP address of a response is an IPaddress of the destination device.
 33. The system of claim 28, whereinthe processor is further configured to execute the instructions toperform the method including: increasing, by the source device, the TTLvalue of each of the first probe and the second probe when more than oneresponding device has not responded to each of the first probe and thesecond probe; and transmitting, from the source device, at least twoprobes having the increased TTL value with a destination set to adestination device; and transmitting, from the source device, at leasttwo probes having the increased TTL value with a destination set to adestination device.
 34. The system of claim 28, wherein the processor isfurther configured to execute the instructions to perform the methodincluding: increasing, by the source device, the TTL value each of thefirst probe and the second probe in response to determining that morethan one of either the first intermediary device or the secondintermediary device has not responded to the two previous transmissionsof probes; and transmitting, from the source device, at least two probeshaving the increased TTL value with a destination set to a destinationdevice.
 35. A non-transitory computer-readable medium storinginstructions that, when executed by a computer, cause the computer toperform a method for determining a topology of a network comprising aplurality of intermediary devices and intermediary paths, the methodincluding: transmitting, from a source device, a first probe and asecond probe to a destination device; in response to each of thetransmitted first probe and second probe, receiving, at the sourcedevice, at least a first response from at least a first intermediarydevice; determining, by the source device, whether a second response hasbeen received from a second intermediary device in response to either ofthe transmitted first probe or second probe; in response to determiningthat a second intermediary device has responded to either of the firstprobe or second probe, determining, by the source device, whether eitherof the first intermediate device or the second intermediate device haveresponded to two previous transmissions of probes; and in response todetermining that either of the first intermediate device or the secondintermediate device has responded to two previous transmissions ofprobes, storing, by the source device, a response received from each ofthe first intermediate device or the second intermediate device inresponse to either of the transmitted first probe or second probe,wherein the source device is configured to determine a network topologybased on the stored responses received from the first intermediarydevice or the second intermediary device.
 36. The computer-readablemedium of claim 35, wherein determining whether a second intermediarydevice has responded to either of the first probe or second probeincludes: comparing, by the source device, the IP address of the firstintermediary device and the second intermediary device for each responsereceived to verify that they are each not the same IP address.
 37. Thecomputer-readable medium of claim 35, wherein determining whether eachof the first intermediate device or the second intermediate device hasresponded to two previous transmissions of probes includes:incrementing, by the source device, a multiple path flag; anddetermining, by the source device, whether the multiple path flag isgreater than one.
 38. The computer-readable medium of claim 35, furthercomprising: storing, by the source device for each probe transmitted,the response received and the TTL value of the transmitted probe. 39.The computer-readable medium of claim 35, further comprising:determining, by the source device, whether an IP address of a responseis an IP address of the destination device.
 40. The computer-readablemedium of claim 35, further comprising: increasing, by the sourcedevice, the TTL value of each of the first probe and the second probewhen more than one responding device has not responded to each of thefirst probe and the second probe; and transmitting, from the sourcedevice, at least two probes having the increased TTL value with adestination set to a destination device.